7. Sustain: Monitoring and Auditing Program Performance

Question 1

Define Metric

Answer 1

provides data that helps to answer specific questions about business operations.

An organization should develop privacy metrics

Question 2

Types of Metric Audiences (PST)

Answer 2

Primary Audiences: legal & privacy officers, CIO, CISO, privacy mangers and executives.

Secondary Audiences: department owners, HR, CFO, HIPPA Officer, IG’s and training organizations.

Tertiary Audiences: external watchdog groups, sponsors and stockholders.

Question 3

Terms: Metric Owner & ROI Analysis

Answer 3

Metric Owner - responsible for managing the metric throughout its life cycle.

ROI Analysis - provides quantitative measurement for the costs, benefits, strengths and weaknesses of an organization’s privacy controls in order to maximize the benefits of investments that prevent loss.

Question 4

4 Ways to Analyze Primary Metrics (TRRM)

Answer 4

• Trend Analysis
• Return of Investment (ROI)
• Business Resiliency
• Program Maturity

Trend, ROI, Resiliency, Maturity (TRRM)

Question 5

Monitor Privacy Programs - to track compliance and risk, organizations alignment with regulatory and legislative changes, and vulnerabilities in the internal and external environment.

Answer 5

• Tracking Compliance and Risk
• Tracking Regulatory and Legislative Changes
• Tracking Environmental Vulnerabilities

Question 6

Forms of Monitoring - Privacy Program

Answer 6

• Active Scanning Tools i.e. Data Loss Prevention
• Audit Activities
• Breach Monitoring, Detection, & Notification
• Complaint Monitoring
• Data Retention
• Control-Based Monitoring
• HR Practices of Hiring & Terminations
• Internal & External Conditions
• Regulation-Based Monitoring

Question 7

What is Privacy Audit

Answer 7

Privacy Audit - involves monitoring and measuring privacy practices to comply with laws, regulations, consent orders, and industry practices.

Question 8

Audit Answers 2 Questions (OC)

Answer 8

1. Privacy Operation do what they were designed to do?
2. Controls correctly managed?

Question 9

Program Maturity Models, different types:

Answer 9

Ad Hoc - informal process

Repeatable - procedures and process, not fully documented or covered

Defined - fully documented, implemented, and cover all relevant aspects

Managed - reviews are conducted to assess control effectiveness

Optimized - regular review and feedback for continual improvement

Question 10

GDPR mandated metrics for reporting

Answer 10

DPIAs conducted

DSARs received

Complaints received

Data security incidents

How many elevated to notifications of DPAs